intertent.net 3.0

When examining running processes and logfiles on OS X, it’s quite common to see calls to open ‘/dev/autofs_nowait’, but what’s the file for??

Looking at the on-disk file doesn’t give many clues:

ls -al /dev/autofs_nowait
crw-rw-rw-  1 root  wheel   10,  27 May  4 17:29 /dev/autofs_nowait

So just how often is this file getting opened and from where?
We can use DTrace to instrument a run of Calculator.app to see what parts of the system are accessing the file:

$ sudo dtrace -qs /dev/stdin -c /Applications/Calculator.app/Contents/MacOS/Calculator
syscall::open*:entry
/execname == "Calculator" && copyinstr(arg0) == "/dev/autofs_nowait"/
{
  printf("open(%s, %d)", copyinstr(arg0), arg1);
  ustack();
}
^D
open(/dev/autofs_nowait, 0)
              libSystem.B.dylib`open$UNIX2003+0xa
              CoreFoundation`CFURLCreateDataAndPropertiesFromResource+0xa6
              CoreFoundation`_CFBundleCopyInfoDictionaryInDirectoryWithVersion+0x4f7
              CoreFoundation`CFBundleGetInfoDictionary+0x55
              CoreFoundation`_CFBundleCreate+0x27d
              CoreFoundation`_CFBundleGetMainBundleAlreadyLocked+0x9d
              CoreFoundation`CFBundleGetMainBundle+0x28
              Foundation`+[NSBundle mainBundle]+0x8e
              AppKit`NSApplicationMain+0x7e
              Calculator`0xab26
              0x1
... Snip, tons more stack traces ...

At the time of this writing, googling for autofs_nowait doesn’t bring up many meaningful results apart from various dumps and logs containging the filename. However looking through the source of autofs on http://www.opensource.apple.com yields the following comment (in kext/auto_vfsops.c:1149):

* Opening /dev/autofs_nowait makes you (but not your children) a
* nowait process; those processes trigger mounts, but don't wait
* for them to finish - instead, they return ENOENT.  This is used
* by launchd.
*
* Closing /dev/autofs_nowait makes you no longer a nowait process;
* it's closed on exit, so if you exit, you cease to be a nowait process.

So it turns out this is used by parts of the system other than just launchd :). A little more poking around with DTrace shows that the pattern seems to be that functions open autofs_nowait then close it at the end of their invocation. This pattern can be seen in the open source portions of CoreFoundation also available on the Darwin Open Source site.